CyberCode Academy

In this lesson, you’ll learn about: Node.js runtime architecture, single-threaded execution risks, global scope vulnerabilities, and HTTP Parameter Pollution (HPP)1. What is Node.js?🔹 Definition:A JavaScript runtime built on:Node.jsChrome V8 engine🔹 Purpose:Run JavaScript outside the browserBuild scalable server-side applications👉 Key InsightNode.js is not a framework—it’s a runtime environment2. Node.js Architecture🔹 Core model:Single-threadedEvent-drivenNon-blocking I/O🔹 How it works:One main event l...

In this lesson, you’ll learn about: Same Origin Policy (SOP), its controlled exceptions, and how attackers exploit it using SOME via Flash callbacks1. What is the Same Origin Policy (SOP)🔹 Definition:A core browser security rule that restricts how documents interact🔹 Enforced in:Web Browsers🔹 Rule:Two URLs can interact only if all match:Protocol (HTTP / HTTPS)Host (domain)Port👉 Key InsightSOP prevents unauthorized access between different websites2. Why SOP Exists🔹 Purpose:Protect user data (cookie...

In this lesson, you’ll learn about: window.opener risks, phishing via tab manipulation, and Same Origin Method Execution (SOME)1. What is window.openerUsing JavaScript:🔹 Definition:A property that gives a newly opened tab access to its parent tab🔹 When it exists:When a link uses target="_blank"👉 Key InsightA child tab can control or modify the parent tab2. Why window.opener is Dangerous🔹 Core issue:Trust between tabs is implicit🔹 Risk:The new tab may be malicious or compromised👉 Key Insight<...

In this lesson, you’ll learn about: Reflected File Download (RFD), Mutation XSS (mXSS), and Relative Path Overwrite (RPO) XSS1. Reflected File Download (RFD)🔹 Definition:A vulnerability where user input is reflected into a response that the browser treats as a downloadable file🔹 How it works (high-level):Attacker crafts a URLServer reflects input into responseBrowser downloads it as a file (e.g., .bat, .cmd)👉 Key InsightThe attack relies more on social engineering than pure technical exploitation2. Why RFD is Dangerous🔹 Core risk:Us...

In this lesson, you’ll learn about: bypassing weak RCE filters and understanding JSON hijacking (legacy browser vulnerability)1. Why RCE Filters Fail🔹 Common mistake:Developers block specific characters (like ;)🔹 Problem:Attack surface is much larger than one delimiter👉 Key InsightBlacklisting single characters is not real security2. Alternative Command Operators🔹 Even if ; is blocked, others exist:&& → execute if first succeeds|| → execute if first fails| → pipe output& → background execution👉 Key InsightThere are multiple ways to chain commands, not just...

In this lesson, you’ll learn about: Remote Command Execution (RCE), blind exploitation techniques, and defensive strategies against command injection1. What is Remote Command Execution (RCE)🔹 Definition:A vulnerability where user input is executed as an OS command🔹 Common in:Python → os.systemNode.js → execPHP → shell_exec👉 Key InsightRCE = user controls what the server executes2. Root Cause of RCE🔹 Problem:Untrusted input passed directly into system commands🔹 Example:ping 127.0.0.1 🔹 Vulnerable usage:ping 👉 Key InsightNo validation = full command...

In this lesson, you’ll learn about: REST limitations, GraphQL fundamentals, and the hybrid approach with Graphiti1. The Problem with REST APIsUsing REST:🔹 Key limitations:OverfetchingClient receives more data than neededUnderfetchingRequires multiple requests to get all dataNo strict typingErrors happen at runtimeHeavy reliance on documentation👉 Key InsightREST is simple and scalable—but not always efficient2. Example of Overfetching🔹 Request:GET /users/1 🔹 Response:{ "id": 1, "name": "John", "email": "john@example.com", "address": "...", "preferences": "...", "settings": "..." } 👉 Problem:<...

In this lesson, you’ll learn about: API pagination, versioning strategies, and building scalable Rails APIs1. Why Pagination Is EssentialUsing Ruby on Rails APIs:🔹 Problem:Returning large datasets (thousands of records)Slow responses + heavy database load🔹 Solution:Break data into pages (chunks)👉 Key InsightPagination improves performance, speed, and user experience2. How Pagination Works (Limit & Offset)🔹 Core idea:limit → how many records per pageoffset → where to start🔹 Example:LIMIT 10 OFFSET 20 👉 Meaning:Skip first 20 recordsReturn nex...

In this lesson, you’ll learn about: modular JSON generation, JBuilder templates, and reusable API response structures1. The Problem with as_jsonUsing Ruby on Rails default serialization:🔹 Issue:Models become bloated with formatting logicBusiness logic + presentation logic get mixed🔹 Example problem:def as_json super.merge(custom_data: ...) end 👉 Key InsightModels should handle data, not how data is presented2. Introducing JBuilderUsing JBuilder:🔹 What it does:Moves JSON generation into view templatesKeeps controllers and models clean🔹 File structure:app/views/projects/show.jso...

In this lesson, you’ll learn about: multi-format responses, JSON serialization, and building clean, reusable Rails API controllers1. Multi-Format Controller ResponsesUsing Ruby on Rails:🔹 Problem:Different clients need different formatsBrowser → HTMLMobile app → JSONExternal systems → XML🔹 Solution:Use respond_todef show @user = User.find(params[:id]) respond_to do |format| format.html format.json { render json: @user } format.xml { render xml: @user } end end 👉 Key InsightOne controller action can serve multiple clients efficiently2. How Clients Choose the Format🔹 Metho...

In this lesson, you’ll learn about: securing APIs in Rails, authentication strategies, and building a stateless authorization system1. Why API Security MattersUsing Ruby on Rails APIs:🔹 Problem:APIs are publicly exposed endpointsWithout protection → anyone can access or manipulate data🔹 Goal:Ensure only authorized users can interact with resources👉 Key InsightAn unsecured API is essentially a “wide-open backend”2. Foundation of API Design🔹 Core features:Multiple response formats (JSON)PaginationAPI versioning🔹 Example:/api/v1/projects?page=1 👉 Ke...

In this lesson, you’ll learn about: system (end-to-end) testing in Ruby on Rails, simulating real browser interactions and validating full user experience1. What Is System (End-to-End) Testing?Using Ruby on Rails:🔹 Definition:Tests the application through a real browser🔹 Difference:Unit → single componentIntegration → backend flowSystem → full user experience (UI + backend)👉 Key InsightSystem tests replicate real user behavior, including clicks and form inputs2. Testing Infrastructure Setup🔹 Core tools:CapybaraSeleniumChrome WebDriver🔹 Requirements...

In this lesson, you’ll learn about: transitioning from unit tests to full integration testing in Ruby on Rails, simulating real user workflows and validating complete application behavior1. What Is Integration Testing?Using Ruby on Rails:🔹 Definition:Tests how multiple components work together🔹 Difference from unit tests:Unit → test isolated partsIntegration → test full workflows👉 Key InsightIntegration tests validate real-world application behavior, not just individual pieces2. Building a Complete User Flow🔹 Example flow:User registersUser logs inUser views pr...

In this lesson, you’ll learn about: building a robust unit testing suite in Ruby on Rails, including methodology, debugging, and test optimization1. The 3-Step Testing MethodologyUsing Ruby on Rails:🔹 Step 1: Identify what to testFunctionModelController🔹 Step 2: Choose inputsRealistic, production-like data🔹 Step 3: Verify outputCompare expected vs actual results👉 Key InsightEvery test follows a clear input → process → output validation flow2. Model Testing (Active Record)🔹 What to test:Record creationRecord deletion...

In this lesson, you’ll learn about: setting up a robust testing environment in Ruby on Rails using isolated databases, parallel execution, and dynamic test data generation1. Project Overview (Testing Context)Using Ruby on Rails:🔹 Application features:User profilesSwipe functionalityMobile-first design🔹 Frontend:Powered by Vue.js👉 Key InsightTesting must reflect real-world usage, especially for interactive apps2. Isolated Test Environment🔹 Principle:Keep test data separate from development data🔹 Why:Prevent data corruptionEnsure repea...

In this lesson, you’ll learn about: implementing user feedback systems in Ruby on Rails using flash messages, validation errors, and UI styling1. The Problem: Lost Feedback After Redirects🔹 Common issue:Messages like “Login Failed” disappear after page reload🔹 Cause:Standard variables don’t persist across redirects👉 Key InsightUser feedback must survive redirects to be effective2. Flash Storage (Temporary Messaging)Using Ruby on Rails:🔹 What is flash:A special storage that persists for one request cycle🔹 Example:flash[:notice] = "Account created successfully" f...

In this lesson, you’ll learn about: session management, secure data storage, and protection against CSRF attacks in Ruby on Rails1. Understanding SessionsUsing Ruby on Rails:🔹 Definition:Sessions allow the app to remember users across requests🔹 Example:User logs in once → stays logged in while navigating👉 Key InsightHTTP is stateless, so sessions provide continuity for user identity2. Managing Sessions in Application Controller🔹 Centralized control:ApplicationController handles authentication globally🔹 Common helper methods:current_user → returns the logged-in userlogged_in? → che...

In this lesson, you’ll learn about: building a secure, membership-based Ruby on Rails application with authentication, encryption, and password recovery1. Building the News Feed FoundationUsing Ruby on Rails:🔹 Core idea:Create a news feed app that fetches live data🔹 Technology:RSS integration (e.g., Google News feeds)👉 Key InsightStart with a functional app, then layer security on top2. Restricting Access (Membership Concept)🔹 Goal:Limit content to authenticated users🔹 Use case:Paid journals / private platforms👉 Key Insight<br...

In this lesson, you’ll learn about: rapid resource building in Ruby on Rails using scaffolding and manual prototyping, and how to balance speed with control1. Understanding CRUD Operations🔹 Core actions:Create → add new dataRead → retrieve dataUpdate → modify dataDelete → remove data👉 Key InsightCRUD operations are the foundation of every web application2. The Power of ScaffoldingUsing Ruby on Rails generators:🔹 Command:rails generate scaffold Crypto name:string price:decimal🔹 What it generates:ModelControllerVie...

In this lesson, you’ll learn about: enforcing low-level business rules in Ruby on Rails using validations, database constraints, and lifecycle hooks to ensure strong data integrity1. Understanding Business Rules🔹 Definition:Business rules = constraints that define how data should behave🔹 Focus:Low-level rules → apply directly to model attributes🔹 Examples:A name must existA ticker symbol must follow a specific format👉 Key InsightBusiness rules translate real-world requirements into enforceable logic2. Application-Level ValidationsUsing Ruby on Rails built-in validators:🔹 Common validations:<br...